[PATCH v2] irqchip/gic-v4: Use a separate lockdep class for vPE doorbell IRQs

[PATCH v2] irqchip/gic-v4: Use a separate lockdep class for vPE doorbell IRQs

[Colton Lewis]

By default, init_desc() assigns the shared irq_desc_lock_class lockdep
key to desc->lock for every struct irq_desc. Device drivers that
register an IRQ affinity notifier establish a lock dependency chain of
&irq_desc_lock_class --> &pool->lock --> &p->pi_lock --> &rq->__lock
when irq_set_affinity_locked() calls schedule_work() while holding
desc->lock.

On GICv4 systems, scheduling out a KVM vCPU calls kvm_sched_out() ->
kvm_arch_vcpu_put() -> vgic_v3_put() -> vgic_v4_put() ->
its_make_vpe_non_resident() -> irq_set_vcpu_affinity() while holding the
scheduler runqueue lock (&rq->__lock). Acquiring the vPE doorbell IRQ's
desc->lock establishes &rq->__lock --> &irq_desc_lock_class, triggering
a lockdep circular locking splat:

  WARNING: possible circular locking dependency detected
  ------------------------------------------------------
  VCPU-0/109705 is trying to acquire lock:
  ffff0001e41e4cc8 (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0x5c/0xb0

  but task is already holding lock:
  ffff00dad15fd260 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x23c/0x1850

  which lock already depends on the new lock.

  Chain exists of:
    &irq_desc_lock_class --> &p->pi_lock --> &rq->__lock

   Possible unsafe locking scenario:

         CPU0                    CPU1
         ----                    ----
    lock(&rq->__lock);
                                 lock(&p->pi_lock);
                                 lock(&rq->__lock);
    lock(&irq_desc_lock_class);

GICv4 vPE doorbell IRQs are internal to KVM and GICv4, set
IRQ_NO_BALANCING, and never register an affinity notifier or queue work
under desc->lock. However, under forced IRQ threading (threadirqs or
CONFIG_PREEMPT_RT), request_irq() creates an IRQ thread for the doorbell
handler, causing irq_set_affinity() -> irq_set_thread_affinity() in
vgic_v4_load() to call wake_up_process() under desc->lock and establish
a real desc->lock --> &p->pi_lock --> &rq->__lock dependency on the vPE
doorbell IRQ itself.

Mark vPE doorbell IRQs with irq_set_nothread() so they are never
force-threaded, and assign them a dedicated lockdep class in
its_alloc_vcpu_irqs() via irq_set_lockdep_class().

Fixes: 8e01d9a396e6 ("KVM: arm64: vgic-v4: Move the GICv4 residency flow to be driven by vcpu_load/put")
Signed-off-by: Colton Lewis <coltonlewis@google.com>
---

Notes:
    Changes in v2:
    - Call irq_set_nothread() on vPE doorbell IRQs in
      its_alloc_vcpu_irqs() so forced IRQ threading cannot create a
      desc->lock -> rq->__lock inversion via irq_set_thread_affinity()
      (Sashiko, Marc Zyngier).
    - Link to v1: https://lore.kernel.org/r/20261023215207.1465369-1-coltonlewis@google.com
    
    An LLM-based coding assistant was used to help analyze the lockdep
    report and draft this patch. I reviewed the analysis and the change.
    
    Tested v2 with threadirqs and CONFIG_PROVE_LOCKING=y on a GICv4.1 host
    with an idpf NIC: confirmed vPE doorbell IRQs remain non-threaded while
    normal IRQs are threaded, and co-pinned vgic_lpi_stress runs after
    bouncing an idpf interface pass with no lockdep warnings. Also
    compile-tested for arm64 against v7.3.

 drivers/irqchip/irq-gic-v4.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c
index 8455b4a5fbb0d..e1e20aeb8fe2a 100644
--- a/drivers/irqchip/irq-gic-v4.c
+++ b/drivers/irqchip/irq-gic-v4.c
@@ -157,6 +157,8 @@ static int its_alloc_vcpu_sgis(struct its_vpe *vpe, int idx)
 
 int its_alloc_vcpu_irqs(struct its_vm *vm)
 {
+	static struct lock_class_key vpe_irq_lock_class;
+	static struct lock_class_key vpe_irq_request_class;
 	int vpe_base_irq, i;
 
 	vm->fwnode = irq_domain_alloc_named_id_fwnode("GICv4-vpe",
@@ -183,6 +185,9 @@ int its_alloc_vcpu_irqs(struct its_vm *vm)
 	for (i = 0; i < vm->nr_vpes; i++) {
 		int ret;
 		vm->vpes[i]->irq = vpe_base_irq + i;
+		irq_set_lockdep_class(vm->vpes[i]->irq, &vpe_irq_lock_class,
+				      &vpe_irq_request_class);
+		irq_set_nothread(vm->vpes[i]->irq);
 		ret = its_alloc_vcpu_sgis(vm->vpes[i], i);
 		if (ret)
 			goto err;
-- 
2.56.0.307.g5fe7bd680c-goog